Loading vulnerability…
Authenticated SQL Injection in Devolutions Server last usage logs
CVE-2025-13757 is an SQL injection vulnerability in the last usage logs component of Devolutions Server. The provided content states that the issue affects Devolutions Server through version 2025.2.20 and through 2025.3.8, and characterizes the flaw as authenticated. Based on the available information, insufficiently sanitized input in functionality related to last usage logs can be used to inject arbitrary SQL statements into backend database queries. The reporting also states that successful exploitation could allow an attacker to steal all passwords stored in the affected system. No further technical details about the specific vulnerable function, parameters, or query construction are available in the provided content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an authenticated attacker to execute unintended SQL queries against the Devolutions Server backend database. Based on the provided reporting, this may enable extraction of highly sensitive data, including all passwords stored in the affected system. Depending on database privileges and application behavior, SQL injection may also permit broader compromise of application data integrity and confidentiality.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to Devolutions Server to only trusted, necessary users and administrative networks, and minimize the number of accounts able to reach the affected functionality. Monitor and alert on anomalous requests involving last usage logs and unexpected database query behavior. Use least-privilege database credentials for the application to limit the blast radius of SQL injection. Where feasible, place the service behind network access controls or a reverse proxy with request inspection, though such measures are compensating controls and not a substitute for patching.
Patch, then assume compromise.
Upgrade Devolutions Server to a fixed release newer than 2025.2.20 and 2025.3.8, as the provided content indicates those versions are affected. Apply the vendor's security update or hotfix addressing CVE-2025-13757 as soon as it is available in your supported release train. Validate that all instances, including standby or test deployments, are updated and review database and application logs for signs of abuse of last usage logs functionality.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.